There's a race condition between the atomic_dec_and_test(&io->count)in dec_count() and the waking of the sync_io() thread. If the threadis spuriously woken immediately after the decrement it may exit,making the on stack io struct invalid, yet the dec_count could stillbe using it.